CVE-2026-62867
Received Received - Intake

Incus Storage Volume Argument Injection Vulnerability

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided `block.create_options` in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject arbitrary arguments into the binary executed as root. Version 7.3.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-62867
EUVD
EUVD-2026-63987

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
incus incus to 7.3.0 (exc)
canonical incus to 7.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62867 is a critical vulnerability in Incus where improper validation of user-provided block.create_options in storage volume configuration allows argument injection. This lets a project-scoped user inject arbitrary arguments into filesystem creation commands executed as root.

Detection Guidance

Check Incus version with 'incus version' to see if it is below 7.3.0. Inspect storage volume configurations for suspicious block.create_options values that may contain command injection patterns like semicolons or command substitutions.

Impact Analysis

This vulnerability allows a project-scoped user with specific permissions to execute arbitrary commands as root, potentially leading to root-level file access, arbitrary command execution, denial of service, or filesystem corruption.

Compliance Impact

This vulnerability could lead to unauthorized root-level access, allowing attackers to read, modify, or delete sensitive data. This may violate GDPR's data protection requirements and HIPAA's security rules for protected health information if exploited.

Mitigation Strategies

Upgrade Incus to version 7.3.0 or later immediately. If upgrading is not possible, restrict project-scoped users' permissions to prevent them from creating storage volumes or modifying block.create_options.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62867. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart